CEH Certification Overview

The EC-Council (International Council of Electronic Commerce Consultants) is a globally recognized organization that provides cybersecurity certifications.

The CEH (Certified Ethical Hacker) certification is a globally recognized credential that shows competence in ethical hacking practices and techniques.

The CEH certification is now ANSI-accredited, signifying that it meets rigorous industry standards.

Even if you have an older, non-ANSI CEH certification, you can still take the exam to obtain the new, ANSI-accredited certification.

To be eligible for the ANSI CEH certification, you need at least two years of relevant experience in cybersecurity.

To apply for the ANSI CEH certification, you need to pay a $100 application fee, unless you've taken an EC-Council training course.

To take the ANSI CEH certification exam, you need to purchase a Pearson VUE exam voucher for $1,199 or an EC-Council voucher for $950 if you've taken their training and have a certificate of attendance.

The EC-Council was founded after the 9/11 attacks, driven by the concern of cyberattacks becoming more prevalent.

A technique used to find security vulnerabilities in systems and software, with the aim of improving security.

A type of ethical hacking that simulates real-world attacks to test an organization's defenses, like a red team in military exercises.

A specific type of penetration testing where testers are adversarial to the organization and network, acting like real attackers.

The act of testing software to identify bugs or vulnerabilities that could be exploited by attackers.

Data belonging to individuals, such as personal information, financial records, and medical records.

The act of being able to understand and replicate attacks to improve security.

The overall security posture of a system or organization, including all its vulnerabilities and strengths.

The importance of frequent and proactive security testing to identify and mitigate vulnerabilities.

A technique used in SQL injection attacks that forces the result of the SQL query to always return true. It's used to bypass security measures and gain unauthorized access to data.

A type of network attack that exploits vulnerabilities in web servers by keeping connections open for an extended period, consuming server resources and making the server unresponsive.

A network protocol used to resolve a hostname (like www.example.com) to an IP address (like 192.168.1.10) and vice versa. It's like a phone book for the internet.

An attack that uses dynamically allocated space to store malicious attack code. It's designed to bypass security measures and execute code on the target system.

A malicious program that spreads itself from one computer to another without user interaction. It can replicate and spread rapidly, causing significant damage. It's like a disease that spreads without a host.

A type of security attack where an attacker sends more data to an application than it can handle, causing the application to crash or expose sensitive information.

A type of network attack that exploits vulnerabilities in databases by injecting malicious SQL queries to manipulate data, gain unauthorized access, or cause damage.

A network protocol that allows devices on a local network to communicate with each other using MAC addresses. It maps IP addresses to MAC addresses.

The Data Link layer is responsible for formatting data to be transmitted over a network's physical medium. It handles tasks like error detection and addressing at the local network level.

The Physical layer is the lowest level of the OSI model, managing the physical transmission of data bits over a network cable or wireless medium. It governs how electrical signals are sent and received.

A MAC address (Media Access Control) is a unique identifier assigned to each network interface card (NIC) in a device. It's a physical address used on a local area network (LAN) for communication between devices.

The OSI model is a conceptual framework that divides network communication into seven distinct layers. Each layer performs a specific function, simplifying network complexity.

A router is a network device that forwards data packets between different networks based on their destination IP address. It connects networks and helps data flow efficiently across the internet.

A switch is a networking device that connects multiple devices on a LAN. It allows communication between devices on the same network by forwarding data packets based on their MAC addresses.

A device that combines both routing and switching functions, acting as a gateway between networks. It can route data packets between different network segments and switch data within a local network.

Bridging refers to connecting two or more network segments, allowing devices on different network segments to communicate with each other. It offers a layer 2 function, similar to switching, but on a larger scale.

The initial stage of ethical hacking where you gather information about your target, identifying their network blocks, individual systems, and potential entry points. This process may uncover sensitive information that can be used later in attacks.

The process of scanning networks to identify active hosts and the services they run. This stage helps identify potential entry points for attackers.

A type of attack that relies on tricking users into giving up sensitive information or granting unauthorized access. This is often considered the easiest way into a system.

A network protocol used for sending and receiving emails. Attackers may exploit vulnerabilities in SMTP servers to gather information about users, like usernames.

A network protocol used for file sharing on Windows systems. Attackers may exploit SMB/CIFS vulnerabilities to gain access to shared folders and files, potentially finding sensitive information.

A crucial stage in ethical hacking where you analyze the data gathered through scanning and information gathering to identify vulnerabilities and potential attack vectors.

The process of exploiting identified vulnerabilities to gain unauthorized access to a system or network. This step relies on the knowledge gathered during previous stages.

The initial phase of ethical hacking, focused on gathering information about the target organization, its systems, and online presence. This helps define the scope of the test and identify potential vulnerabilities.

A subset of reconnaissance that specifically focuses on identifying the target's network infrastructure, including its size, network blocks, host systems, geographic locations, and associated personnel. This helps establish a 'footprint' of the target's digital presence.

A set of structured steps or guidelines used to perform ethical hacking activities. It ensures consistency, repeatability, and verifiability of testing procedures, allowing for better reporting and remediation of identified vulnerabilities.

An organization that promotes responsible and ethical cybersecurity practices. It offers the globally recognized Certified Ethical Hacker (CEH) certification, which demonstrates competency in ethical hacking techniques and adheres to a strict code of conduct.

A globally recognized professional certification awarded by EC-Council. It affirms an individual's knowledge and skills in ethical hacking, emphasizing responsible and ethical use of hacking techniques.

A set of principles and guidelines that CEH certified professionals must strictly adhere to. It emphasizes responsible hacking conduct, including minimizing harm, respecting confidentiality, and working towards enhancing the security posture of organizations.

The practice of simulating real-world hacking attacks on systems and networks to identify vulnerabilities and improve security defenses. This helps organizations strengthen their security posture by understanding how attackers might try to exploit weaknesses.

The information gleaned from reconnaissance and footprinting is critical for informing the security recommendations and improvements that can be implemented to strengthen the organization's security posture.

A structured process of ethical hacking that involves a series of steps including reconnaissance, scanning, enumeration, vulnerability analysis, exploitation, and reporting. This ensures a systematic approach to security testing and provides a clear framework for documenting findings and recommending solutions.

The process of gathering information about the target organization, its systems, and online presence, including publicly available data like website information, employee details, and network infrastructure.

A type of reconnaissance focusing on identifying the target's network infrastructure, including its size, network blocks, host systems, geographic locations, and associated personnel. It helps establish a 'footprint' of the target's digital presence.

The practice of identifying and documenting the security vulnerabilities and weaknesses found during ethical hacking activities. It involves compiling the findings, providing detailed descriptions of discovered vulnerabilities, and recommending strategies for mitigation and remediation.

A network device that connects multiple devices on a LAN, allowing communication between devices on the same network by forwarding data packets based on their MAC addresses. It allows for efficient communication by providing a dedicated path for data transmission between connected devices.

The process of gathering information about the target's network traffic, including internet activity, data transfers, communication patterns, and user behavior. This stage might involve using network sniffing tools to capture and analyze data packets, revealing communication patterns and potential vulnerabilities.

The core steps in ethical hacking and penetration testing, outlined in a structured manner to ensure thoroughness and consistency.

It's a crucial phase before any hacking, gathering information about the target, its systems, network blocks, and online presence to identify possible attack vectors.

The act of scanning networks for active hosts and running services to identify potential weak points and entry points for attackers.

A stage where vulnerabilities identified during scanning and information gathering are analyzed to determine potential attack vectors and how they can be exploited.

A structured approach to ethical hacking that ensures consistency, repeatability, and verifiability of testing procedures.

The critical step after vulnerability analysis, where identified weaknesses are exploited to gain unauthorized access or demonstrate the impact of an attack.

A core aspect of information gathering where the process of gathering information about target company, network, its personnel, and their locations is conducted.

A structured approach to improve security and identify vulnerabilities by understanding how real attackers might try to exploit weaknesses.

A conceptual model used to describe communication protocols and their functions, divided into seven layers, each dedicated to a specific aspect.

A networking device that connects different networks and forwards data packets between them based on destination IP addresses.

A technique used to hide one protocol inside another, often to bypass security measures or send unauthorized commands.

A type of attack where a small DNS request triggers a much larger response sent to the target, amplifying the attack's impact.

The process of looking up information from one DNS server to another, typically in a hierarchical manner to find the most authoritative answer.

A process where a DNS server requests all the contents of a zone from a more authoritative server, ensuring the local server has the most up-to-date information.

A network scan that sends ICMP echo requests to a range of IP addresses to identify active hosts on the network.

A system for managing cybersecurity risks and establishing a framework for organizations to improve their security posture.

A cryptographic method used for key exchange, allowing two parties to securely establish a shared secret key for communication.

A programming language known for its simplicity and readability, often used in malware development due to its easy availability and wide range of libraries.

Informing those involved about identified issues and potential conflicts of interest.

A responsible approach to revealing vulnerabilities, working with vendors and CERTs before public disclosure.

Agreeing to not misuse client or company resources, including avoiding damage.

The principle of avoiding any illegal actions or activities.

Gathering information about a target, including systems, network blocks, and online presence.

Analyzing identified vulnerabilities to determine potential attack vectors and how they can be exploited.

Exploiting vulnerabilities to gain unauthorized access or demonstrate the impact of an attack.

A historical networking protocol used on the initial ARPANET, later superseded by the TCP/IP suite.

A suite of protocols used for communication on the internet. Consists of four layers: Application, Transport, Internet and Network.

The layer in both the OSI Model and TCP/IP Architecture responsible for formatting data and providing reliable communication between applications.

The layer in both the OSI Model and TCP/IP Architecture responsible for routing data packets across networks.

In the TCP/IP model, it combines functions of the OSI Model's Session, Presentation and Application layers to focus on network applications.

The layer in the OSI Model responsible for controlling the physical transmission of data bits over a network cable or wireless medium.

The lowest layer of the OSI model, responsible for the physical transmission of data bits over a network cable or wireless medium.

The second layer of the OSI model, responsible for formatting data for transmission over a physical medium, handling error detection and addressing at the local network level.

The third layer of the OSI model, responsible for routing data packets between networks, ensuring data packets reach their intended destination.

The fifth layer of the OSI model, responsible for managing communication between devices, including session establishment, termination, synchronization, and data exchange.

The sixth layer of the OSI model, responsible for presenting data in a format that can be understood by other applications, handling data encryption and decryption, and data compression.

The seventh and highest layer of the OSI model, responsible for user interactions with network applications and providing services like email, file transfer, and web browsing.

A structured process used in ethical hacking to test an organization's security, revealing vulnerabilities and recommending improvements.

The initial stage of ethical hacking, focusing on collecting information about the target, its systems, and online presence to pinpoint vulnerabilities.

The process of scanning networks for active hosts and running services to identify potential weak points for attackers.

The step where vulnerabilities found during scanning and information gatheringare analyzed to determine potential attack vectors.

The critical step after vulnerability analysis where identified weaknesses are exploited to gain unauthorized access or demonstrate the impact of an attack.

A core aspect of information gathering where the process of gathering information about the target company, network, its personnel, and their locations is conducted.

A structured approach to improve security and identify vulnerabilities by understanding the attackers' motives and methodologies.

The minimum requirement to apply for the ANSI-accredited CEH certification, signifying a hands-on understanding of cybersecurity.

The fee associated with the CEH application, unless you've completed an EC-Council training course, demonstrating commitment.

The step in ethical hacking where identified vulnerabilities are analyzed to determine their potential for exploitation by attackers, understanding the risks.

The act of scanning networks for active hosts and running services to identify potential weak points and entry points for attackers.

A core aspect of information gathering where the process of gathering information about the target company, network, its personnel, and their locations is conducted.

A technique used to maintain access to a compromised system, often by installing malware like rootkits to create backdoors, obscure actions, and establish persistent access. This ensures continued monitoring and potential further exploitation.

The practice of hiding or deleting evidence of your presence on a compromised system. This can involve deleting logs, using malware to misreport system information, and obscuring network connections.

Installing software on a target system after the initial compromise to maintain access. Requires copying the software, which can be challenging depending on the system's security measures.

Hiding the existence of a backdoor or other malicious software on a compromised system, often by masking its actions, altering system logs, and manipulating network traffic patterns.

Malware that provides persistent access to a compromised system, even after the initial attack. This can be used to monitor activity, exfiltrate data, or launch further attacks.

A method for maintaining access to a compromised system, often used by attackers for persistent monitoring and control. This allows them to continue their operations, even if the initial attack vector is removed.

The act of modifying system logs to hide or distort evidence of an attack. This involves manipulating the records of system events to make it appear like an attack never happened.

A critical step in ethical hacking and penetration testing, involving the strategic use of identified vulnerabilities to gain unauthorized access or demonstrate the impact of an attack.